Searchjacked: 319 Chrome extensions hijack search for 13.4M users, how to check

Security firm Socket published a report on 29 October 2026 that ties 319 Chrome extensions, with roughly 13.4 million reported installs over about a decade, to search hijacking. The extensions quietly replace Chrome's default search engine and send every search through a server run by the operator before it reaches Yahoo or Bing. Many are unlisted in the Chrome Web Store and spread through ads, so users rarely search for them and often cannot say how they got installed. If your Chrome search results look odd, or the search engine keeps changing back, this is the first thing to check.

Key points

• Socket (researcher John Tuckner) counts 319 extensions and about 13.44 million reported users across them, the earliest dating to 2016.
• Of these, 264 extensions with about 8.7 million users are newly identified; the rest build on Socket's earlier work.
• The hijack needs no special permissions: one chrome_settings_overrides entry in the manifest sets a new default search provider.
• Searches pass through operator-controlled proxies, and the operators earn referral payments from Yahoo or Bing under a partner ID.
• Socket did not observe phishing or malware delivery, but says the proxy design would allow it.

What to do

• Check your search engine: in Chrome, open More (three dots) > Settings > Search engine and make sure the default is the one you chose. Google's help page says "Change" there lets you pick a different default.
• Review your extensions: open chrome://extensions and remove any you do not recognise, especially "safe search", PDF converter, manual finder, "security" or AI search tools you do not remember installing.
• Compare against the list: Socket's report lists the extensions; check it for names you have installed. BleepingComputer, which covered the report, advises uninstalling those listed and running a full antivirus scan.
• Reduce the risk going forward: install add-ons only from publishers you can identify, and treat an extension whose only job is to change your search provider as suspect.
• Companies: IT teams can audit installed extensions across managed browsers and block unknown ones by policy.

What happened

Socket's report, "Searchjacked", describes a long-running ecosystem of extensions whose real product is the search traffic of the people who install them. The firm counts 319 extensions and about 13.44 million users in total. It says 264 of them, with about 8.7 million users, are newly identified. BleepingComputer notes that this builds on a report Socket published in April 2025 about 57 extensions and about 6 million users. (57 plus 264 is 321, not 319, so the earlier and newer counts do not simply add up; we use Socket's stated totals.)

Socket splits the extensions into those it could tie to a named operator and those it could not.

type: bar
title: Reported users by cluster or operator (Socket)
unit: million users
source: Socket, "Searchjacked", 29 October 2026
highlight: SecuryBrowse
SecuryBrowse (58 extensions) | 4.9
Bing-Search (37 extensions) | 2.2
Intango LTD (111 extensions) | 2.19
Free Planet VPN S.R.L (1 extension) | 2.0
HermesTab (2 extensions) | 0.4
Kinner Lake Ltd (6 extensions) | 0.3
Mutual Media and individuals (9 extensions) | 0.26

Of the 319, Socket attributes 200 extensions (about 5.68 million users) to 21 named operators or groups, and 119 (about 7.76 million users) to operators it could not identify. The largest unnamed cluster, which Socket calls "SecuryBrowse", has 58 extensions and about 4.9 million users, with names such as Fire Shield, Wise Ghost, Securify, Protecto and WatchTower. A second, "Bing-Search", has 37 extensions and about 2.2 million users and is pushed through Bidbrain ads. Among the named operators, the biggest by extension count is Intango LTD, an ad-tech company, with 111 extensions and about 2.19 million users. Socket also names well-known search-syndication businesses among the operators, including System1, Perion Network and ValidClick/Inuvo, though with far smaller user counts (roughly 91,000, 50,000 and 140,000 users respectively). Socket's report does not claim that every one of those companies runs malicious software; it describes the shared mechanism and who sits behind each extension.

The extensions pose as PDF converters, manual finders, safe-search tools, weather pages and AI search helpers. Socket says many are unlisted in the Chrome Web Store, so they do not appear in store search, and are pushed through pop-overs and pop-unders on low-quality ad networks. Some were removed from the store before Socket could record them: it says Intango's 12 advertised extension IDs were among them. BleepingComputer, which reached Google for comment, reported no reply by publication and says most of the extensions had been removed from the store by then, while new ones keep being added. Socket's report itself says the Chrome Web Store "hasn't kept up", and that new domains keep appearing after takedowns.

Background

Search hijacking is one of the oldest browser-extension abuses. Chrome has a documented way for an extension to offer a search engine: the search_provider field inside chrome_settings_overrides. Google's developer documentation says search_url and is_default are required, and that any domain used must be verified in Google Search Console by the same developer account that publishes the extension. It also says that an extension combining a settings override with other capabilities or permissions can trigger a confirmation dialog in Chrome 107 and later, while an extension that modifies only this one setting does not get that dialog.

That last detail matters here. Socket's example, an extension called "Safe Game Search", has no permissions, no background worker, no content scripts and no user interface. It contains little beyond a manifest and icons, so nothing about it looks dangerous in a permissions list. The earliest extensions Socket tracked date to 2016, including a "Yandex search" extension with about 200,000 users that forced Yandex as the default and has since been taken down, and "HermesTab", two extensions with about 400,000 users that took over the new-tab page with Yahoo.

How it works

The mechanics are simple, which is part of why the scheme has lasted:

1. The manifest sets the provider. The extension declares a search_provider with is_default: true. When it is installed, Chrome's default search engine becomes the operator's.
2. Searches go through a proxy. The search URL points at the operator's server rather than at Bing or Yahoo. The operator sees each query, often tied to a unique identifier, and then forwards the user to a Yahoo or Bing results page.
3. The operator is paid per search. Yahoo uses parameters such as hspart and hsimp; Bing uses PC and PTAG. These identify the syndication partner who gets paid for the traffic. Socket traces several clusters by these identifiers, for example Yahoo hspart=iba for Intango and hspart=flowsurf for Kinner Lake.
4. The destination can change per search. In Socket's testing, six identical searches through the Predator Search extension (ID odkcfoohjiicbelloepgcomekdknchjh, 50,000 users) ended up at four different destinations, including Yahoo, a landing page at searchlio.net and a Cloudflare error page.

Because the proxy chooses the destination as each search arrives, it can change what users see without shipping an extension update, which is also why store review of the extension file alone cannot catch it.

What it means

For ordinary users, the practical cost is mostly privacy and annoyance: every query is visible to a third party, results can be degraded or redirected, and the browser's search setting may be reset by an extension you forgot. Socket's report warns that the same arrangement could in principle send a user to phishing pages or malicious downloads, but it says it is assuming this, and it did not observe such redirects. Install counts are cumulative over a decade and are not a measure of how many people are exposed today, and it is not confirmed that every operator stores or sells the queries it sees.

For Google, the report is an uncomfortable test of the extension store's review process. The behaviour is declared openly in the manifest, so the extensions are doing what the documentation allows; the question is whether a settings override that exists only to route searches through a proxy should be allowed at all. Socket's author argues such extensions "should be considered malicious by definition." Google had not commented in the coverage we read, and we do not know whether it plans policy changes.

For security teams, the lesson is that "no sensitive permissions" does not mean "harmless". An audit that only flags extensions requesting broad host access would miss every extension in this report. A useful check is to look for extensions that override the search provider or new-tab page, and to compare the partner parameters in search URLs against the list in Socket's report.

What we don't know yet

• Current exposure. Socket counts reported installs over about ten years. It does not say how many of the 13.4 million users still have an extension installed today, and many extensions have since been removed.
• What operators do with the queries. Socket says proxies can see each query; whether all operators keep, sell or analyse them is not established.
• Google's response. We found no statement from Google, and BleepingComputer's request for comment had not been answered at publication.
• Who is behind the unnamed clusters. Socket could not identify the operators of 119 of the extensions, including the two biggest clusters, and says advertisers who buy install ads are hard to identify.

What to watch next

Watch for a Google statement, or a change to the Chrome Web Store policy on settings overrides, and for whether Chrome adds a confirmation dialog for search-provider changes made by extensions that request no other capability. Also watch whether Yahoo and Bing, whose syndication programmes pay these operators, act against partners named in Socket's report. We will add a dated update to this article if any of that appears.

Sources

• Socket: Searchjacked, Hidden Browser Extensions Hijack Searches for 13 Million Users (primary report, John Tuckner, 29 October 2026)
• BleepingComputer: Chrome extensions with 13.4 million installs caught hijacking searches
• Chrome for Developers: Override Chrome settings (chrome_settings_overrides)
• Google Chrome Help: Change your default search engine